EUVD-2026-73382
GHSA-438x-m8qh-h4mv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Low-privilege authenticated network access suffices; only confidentiality is impacted with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
AnalysisAI
Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a network-connected low-privilege authenticated attacker to read sensitive data from SQL Server memory. The flaw (CWE-908) arises when the engine allocates and uses memory without proper initialization, potentially exposing contents from adjacent queries, sessions, or internal data structures. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SQL Server database login with at minimum low-privilege access (PR:L per CVSS vector); unauthenticated attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) represents a realistic moderate-high risk: the only barrier to exploitation is possession of a low-privilege database login, which is commonly granted to application service accounts, analysts, or developers in multi-tenant and shared database environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches to bring each SQL Server instance within the fixed version range: SQL Server 2017 CU31 to 14.0.3550.4 or later; SQL Server 2017 GDR to 14.0.2130.4 or later; SQL Server 2019 CU32 to 15.0.4490.9 or later; SQL Server 2019 GDR to 15.0.2190.7 or later; SQL Server 2022 CU26 to 16.0.4275.2 or later; SQL Server 2022 GDR to 16.0.1200.5 or later; SQL Server 2025 CU8 to 17.0.4085.5 or later; SQL Server 2025 GDR to 17.0.1135.8 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today